Logic Flaw: SM4_ENCRYPT/DECRYPT functions return plaintext without warning in Community Edition

Start in source/libs/crypt/src/crypt.c, especially Builtin_CBC_EncryptImpl and the non-TD_ENTERPRISE path, then reproduce the behavior with ./taos using the SM4_ENCRYPT query shown. Trace how the routine's return value reaches the SQL function and verify that unsupported Community Edition calls report an explicit error instead of returning plaintext with Query OK.

Bug Description
In the Community Edition build, the SM4 cryptographic routines are stubbed out using a memcpy operation, but the system processes the functions with a silent success status (Query OK). This creates a critical logical flaw and a false sense of security, as users are led to believe their data is encrypted when it is actually processed and stored as raw plaintext.

To Reproduce
Steps to reproduce the behavior:

1. Open the interactive client terminal by running ./taos.
2. Select or use any database context (USE test_vuln;).
3. Execute the SM4 encryption query followed by the AES encryption query to see the plaintext leak vs expected behavior:

taos> SELECT SM4_ENCRYPT('HelloGhost12345', 'my_sm4_key_16_ch') FROM secure_data;
 sm4_encrypt('HelloGhost12345', 'my_sm4_key_16_ch') |
=====================================================
 HelloGhost12345                                    |
Query OK, 1 row(s) in set (0.066803s)

taos> SELECT AES_ENCRYPT('HelloGhost12345', 'my_aes_key_16_ch') FROM secure_data;
 aes_encrypt('HelloGhost12345', 'my_aes_key_16_ch') |
=====================================================
                                                    |
Query OK, 1 row(s) in set (0.011350s)

4. Notice that the SM4 output returns the raw, unencrypted plaintext string HelloGhost12345 while Query OK is advertised.

Expected Behavior
If the SM4 algorithm is restricted or unimplemented in the Community Edition, the engine should explicitly fail and throw a proper error code (e.g., Function not supported in this edition) instead of failing open, silently copying plaintext, and misleading the operator.

Environment:

• OS: Debian
• TDengine Version: 3.4.1.6

Additional Context
The root cause lies in source/libs/crypt/src/crypt.c. When TD_ENTERPRISE is not defined, the core routines fall back to Builtin_CBC_EncryptImpl, which performs a direct data copy:

int32_t Builtin_CBC_EncryptImpl(SCryptOpts *opts) {
    memcpy(opts->result, opts->source, opts->len);
    return opts->len;
}

While commercial gating is understandable, performing a silent memcpy without a runtime warning propagates unencrypted data into architectural call sites (like WAL logs and local configurations) while advertising them as secure.